Skip to content
Heist/ feed
Back to feed
Medium

Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Type: advisorySources: OSV

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-82267
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 16:13 UTC · Revision 1

Source evidence

Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

core-osv · Original source

Published 28 Aug 2026, 16:18 UTC

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.

osv:CVE-2026-82267
Complete source record
{
  "id": "4b958c820a33ed1a35700c960aeada72db1202f126df01389fc3040c22f24ee9",
  "url": "https://osv.dev/vulnerability/CVE-2026-82267",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
    "summary": "Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.",
    "evidence": "osv:CVE-2026-82267",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-82267",
      "aliases": [
        "CVE-2026-82267"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/moghtech/komodo",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "cc1c5aa5dabb738e843c47f5e87fc040648c2bb7"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.3.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.3.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v2.0.0-dev-35",
            "v1.19.5",
            "v1.19.4",
            "v1.19.3",
            "v1.19.2",
            "v1.19.1",
            "v1.19.0",
            "v1.18.4",
            "1.18.5-dev-5",
            "v1.18.3",
            "v1.18.2",
            "v1.18.1",
            "v1.18.0",
            "v1.17.5",
            "v1.17.4",
            "v1.17.4-dev-1",
            "v1.17.3",
            "v1.17.2",
            "v1.17.2-dev-1",
            "v1.17.1",
            "v1.17.0",
            "v1.17.0-dev-6",
            "v1.17.0-dev-5",
            "v1.17.0-dev-2",
            "v1.16.12",
            "v1.16.11",
            "v1.16.10",
            "v1.16.9",
            "v1.16.8",
            "v1.16.7",
            "v1.16.6",
            "v1.16.5",
            "v1.16.4",
            "v1.16.3",
            "v1.16.2",
            "v1.16.1",
            "v1.16.0",
            "v1.15.12",
            "v1.15.11",
            "v1.15.10",
            "v1.15.9",
            "v1.15.8",
            "v1.15.7",
            "v1.15.6",
            "v1.15.5",
            "v1.15.4",
            "v1.15.3",
            "v1.15.2",
            "v1.15.1",
            "v1.15.0",
            "v1.14.2",
            "v1.14.1",
            "v1.14.0",
            "v1.14.0-rc1",
            "v1.13.4",
            "v1.13.3",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.3",
            "v1.7.0",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0",
            "v0.3.4",
            "v0.3.3",
            "v0.3.2",
            "v0.3.0",
            "v0.2.14",
            "v0.2.13",
            "v0.2.12",
            "v0.2.11",
            "v0.2.10",
            "v0.2.9",
            "v0.2.7",
            "v0.2.6",
            "v0.2.5",
            "v0.2.4",
            "v0.2.1",
            "v0.2.0",
            "v0.1.17",
            "v0.1.16",
            "v0.1.15",
            "v0.1.11",
            "v0.1.10",
            "v0.1.9"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82267.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.156361645Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82267.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-82267",
        "https://www.vulncheck.com/advisories/komodo-resource-identifier-disclosure-and-audit-log-pollution-before-permission-check",
        "https://github.com/moghtech/komodo/issues/1455",
        "https://github.com/moghtech/komodo",
        "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/api/execute/mod.rs",
        "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/helpers/update.rs"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82267.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82267",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497198,
  "published_at": "2026-08-28T16:18:51.391+00:00"
}